CVE-2026-15100 describes a stored cross-site scripting vulnerability in the Post Grid Gutenberg Blocks – PostX plugin for WordPress. The issue involves improper neutralization of input during web page generation (CWE-79) specifically through the 'searchnoresult' block attribute. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript into posts, which executes in the browser sessions of users who preview or view these posts, including those with elevated privileges. The vulnerability affects all plugin versions up to and including 5.0.32. No official patch or remediation level has been published as of the data provided.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts into WordPress posts. These scripts execute in the context of higher-privileged users (Editors, Administrators) when they view or preview the compromised content, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and avoid previewing or publishing content from untrusted contributors. Monitor for updates from the plugin vendor or WordPress security advisories to apply official patches once released.